---
id: ADR-PFM-NOT-003
title: Producers Publish Inside Their Own Transaction Through an Insert-Only Role
product_area: platform
module: notifications
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: Producers insert a workspace-bound queue entry through an insert-only capability within their
  own business transaction.
constrains:
- DOM-PFM-NOT-003
- DOM-PFM-NOT-005
- SVC-PFM-NOT-notifications
- SVC-PFM-NOT-communications
- WF-PFM-NOT-002
- WF-PFM-NOT-010
- WF-PFM-NOT-009
origin: PLAT-M23 plan approved by Andrew 2026-10-21 18:05 ET (publishNotification called in the producer's
  own transaction; the capability role), services-platform:docs/milestones/plans/PLAT-M23-plan.humanized.md#6.
  Approach; Andrew 2026-10-09 (other services insert-only into the submissions table), services-platform:docs/communications/architecture.md#2026-10-09
  — Final acceptance
alternatives:
- option: Call Platform over the network after commit
  why_not: A call after commit can be lost during a crash, while a call before commit can announce a rolled-back
    change.
- option: Publish a business event and let Platform subscribe
  why_not: Business-event adoption introduces separate producer contracts and still requires reliable
    transport.
consequences:
- Commit makes a queue entry dispatchable; it does not guarantee an eventual notice or e-mail.
- Each external producer needs the submission capability granted to its service role.
- Platform receipt doors produce the same transport shape as transactional helpers.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: docs/notifications.md §2; docs/communications/architecture.md §16.8
  and §18.3; docs/row-level-security.md (submission tables).'
---
# Producers Publish Inside Their Own Transaction Through an Insert-Only Role

## Context

An announcement must not become dispatchable when the business transaction that caused it rolls back.

## Decision

Producers insert a workspace-bound queue entry through an insert-only capability within their own business transaction.

## Alternatives Considered

A call after commit can be lost during a crash, while a call before commit can announce a rolled-back change. Business-event adoption introduces separate producer contracts and still requires reliable transport.

## Consequences

Commit makes a queue entry dispatchable; it does not guarantee an eventual notice or e-mail. Each external producer needs the submission capability granted to its service role. Platform receipt doors produce the same transport shape as transactional helpers.